f966c826ea1be819f8d2bc05bd62d499d963f08a08e79a5658aa5d85e5c42f83

Analysis

max time kernel
229s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:50

Target

f966c826ea1be819f8d2bc05bd62d499d963f08a08e79a5658aa5d85e5c42f83.dll
Size

48KB
MD5

150d7daf2f5f55340e600a1d0d4f0790
SHA1

b88d2c120b8e4058e30f1e7d07f84bf2b4e4c0b7
SHA256

f966c826ea1be819f8d2bc05bd62d499d963f08a08e79a5658aa5d85e5c42f83
SHA512

da35d55409f101a9e594bad955c7116c12b5e1a85133bf284aa0c9647ae022323dfaa731026adf1cc473f5686a66797ea9c1161ee278bbe75f2fffd53f48eb7b
SSDEEP

768:UK/U1Tk8dPHH0IW4OHxE4qUeTsNF2vy1cZEN6qYRP/KRiaVAGU6VHEp1tSljCXtU:p/Kw8d2REUeQN8vy1e4NYRPi77U6yp34

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28
PID 628 wrote to memory of 1916	628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f966c826ea1be819f8d2bc05bd62d499d963f08a08e79a5658aa5d85e5c42f83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f966c826ea1be819f8d2bc05bd62d499d963f08a08e79a5658aa5d85e5c42f83.dll,#1
  2⤵
  PID:1916

memory/1916-54-0x0000000000000000-mapping.dmp

Download
memory/1916-55-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1916-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1916-57-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1916-58-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1916-59-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1916-60-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download